Latest Gitea vulnerability: CVE-2026-60004 #
Gitea disclosed that certain versions of Gitea are affected by a remote code execution (RCE) vulnerability within the diffpatch feature. By exploiting this through malicious repository content, an attacker can write custom Git hooks into the underlying repository directory. When these hook scripts are subsequently triggered during Git operations, they execute arbitrary shell commands with the privileges of the Gitea process user. The vulnerability has been designated CVE-2026-60004 and has been rated critical with a CVSS score of 9.8.
On default installations where open self-registration is enabled, successful exploitation allows a remote, unauthenticated attacker, or any user with repository write access, to execute arbitrary commands with the privileges of the Gitea process. Depending on the service account's permission level, successful compromise enables an attacker to extract sensitive credentials and configurations, and may allow for altering build outputs, potentially threatening the integrity of downstream artifacts.
The following versions are affected
- Gitea: Versions 1.17 through 1.27.0 (inclusive)
What is Gitea? #
Gitea is an open-source, self-hosted Git service written in Go that provides web-based repository hosting, issue tracking, and code review capabilities using minimal system resources.
What is the impact? #
Successful exploitation of this vulnerability would allow a remote attacker to achieve full remote code execution on the host server with the privileges of the Gitea process, exposing system secrets and credentials while creating potential risk to downstream build pipelines.
Are any updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- Gitea: Upgrade to version 1.27.1 or later.
How to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:=Gitea AND product:=Gitea
